CREST OSINT & Reconnaissance Techniques 3

Question 1

What is the primary purpose of 'Google hacking' (Google dorking) in a penetration testing engagement?

Accepted Answer

Using advanced search operators to find sensitive information and misconfigured systems indexed by Google

Answer

Breaking Google's authentication and authorization controls

Answer

Performing denial-of-service attacks through search engine queries

Answer

Bypassing CAPTCHA systems on Google login pages

Question 2

What is the Wayback Machine (web.archive.org) primarily used for during OSINT investigations?

Accepted Answer

Accessing historical archived snapshots of websites to find previously exposed information

Answer

Monitoring real-time network traffic from target systems

Answer

Scanning websites for current security vulnerabilities

Answer

Enumerating active directory users from web applications

Question 3

According to CREST penetration testing methodology, during which phase should OSINT and reconnaissance be conducted?

Accepted Answer

Pre-engagement and reconnaissance, before active testing begins

Answer

Post-exploitation and pivoting

Answer

Reporting and documentation

Answer

Vulnerability scanning and exploitation

Question 4

Why is identifying an organization's CIDR blocks an important step in OSINT during scope definition?

Accepted Answer

To map all IP address ranges owned by the target, ensuring complete and accurate test scope

Answer

To determine the organization's software development methodology

Answer

To discover employee email addresses and social media profiles

Answer

To locate the organization's physical offices and data centers

Question 5

Which technique involves querying historical DNS resolution data to find IP addresses previously associated with a domain?

Accepted Answer

Passive DNS analysis

Answer

Active DNS brute-forcing

Answer

Zone transfer enumeration

Answer

Reverse DNS scanning

Question 6

In OSINT, what is 'social engineering reconnaissance' specifically used to build?

Accepted Answer

A detailed profile of target individuals and organizations using social media and public data

Answer

A map of network vulnerabilities in the target's perimeter

Answer

A list of unpatched software versions running on target servers

Answer

A database of valid credentials from previous data breaches

Question 7

What OSINT resource provides a categorized, web-based collection of hundreds of tools organized by data type for investigators?

Accepted Answer

OSINT Framework (osintframework.com)

Answer

MITRE ATT&CK Navigator

Answer

OWASP Testing Guide

Answer

PTES (Penetration Testing Execution Standard)